CVE-2023-32983

2023-05-1616:15:10

Google

osv.dev

jenkins

ansible

plugin

configuration

vulnerability

attackers

capture

extra variables

5.3 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

LOW

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N

7 High

AI Score

Confidence

High

0.0005 Low

EPSS

Percentile

18.3%

JSON

Jenkins Ansible Plugin 204.v8191fd551eb_f and earlier does not mask extra variables displayed on the configuration form, increasing the potential for attackers to observe and capture them.

CPENameOperatorVersion
ansible-plugineqansible-0.5
ansible-plugineqansible-0.1
ansible-plugineqansible-0.6
ansible-plugineqansible-0.6.1
ansible-plugineq174.vfd5323d2b_9d8
ansible-plugineq204.v8191fd551eb_f
ansible-plugineqansible-0.4
ansible-plugineq146.v431a_a_39d472d
ansible-plugineqansible-0.2
ansible-plugineqansible-0.7

Name	Operator	Version
ansible-plugin	eq	ansible-0.5
ansible-plugin	eq	ansible-0.1
ansible-plugin	eq	ansible-0.6
ansible-plugin	eq	ansible-0.6.1
ansible-plugin	eq	174.vfd5323d2b_9d8
ansible-plugin	eq	204.v8191fd551eb_f
ansible-plugin	eq	ansible-0.4
ansible-plugin	eq	146.v431a_a_39d472d
ansible-plugin	eq	ansible-0.2
ansible-plugin	eq	ansible-0.7